Getting TCP retransmission errors

errorstcp

I have taken some transaction captures using WireShark.

I have 3 servers, 1 web server connecting to an app server (locally) and then the same web server connecting to a remote app server… the captures I have taken; some use the route of web server to app server (locally), and another transaction would use web server to app server (remotely).

Basically I am getting TCP retransmission errors both ways (remote and local), or duplicate frames being sent on a very severe basis within my captures.

I know what they are and I know its typically due to network congestion. But how can I find out WHY??

Best Answer

Just as a comment, sometimes what appear to be duplicate frames can be caused by network adapter drivers getting mixed up with capture drivers.

If you see a clear pattern of TCP retransmission backing off, that is, a retransmit at 1 second, then 2, then 5, it's likely an actual problem with retransmissions, rather than a capture artifact.

To troubleshoot retransmission problems for real, within a local subnet that you control and are sure isn't just saturated with traffic, replace or adjust:

  • NIC drivers - try lower-end drivers, disable whizbang features, un-team, un-complicate
  • NICs
  • Switches
  • cables

If one of the boxes is more likely to be involved in a retransmission than the others, you can infer which link this might be from that.